Configurable code fingerprint

ABSTRACT

A method, computer program product, and system performing a method that include a processor defining a code fingerprint by obtaining parameters describing at least one of an event type or an event. The code fingerprint includes a first sequence. The processor loads the code fingerprint into a register accessible to the processor. Concurrent with executing a program, the processor obtains the code fingerprint from the register and identifies the code fingerprint in the program by comparing a second sequence in the program to the first sequence. Based on identifying the code fingerprint in the program, the processor alerts a runtime environment where the program is executing.

BACKGROUND

A code fingerprint, referred to herein also as a fingerprint, isspecific processor behavior that occurs when a given section of code isexecuting. This processor behavior includes any recognizable behaviorsuch as a particular sequence of branch prediction hits and misses, aparticular sequence of data cache hits and misses, a particular sequenceof taken and not taken branch instructions, and/or any other behavior orpattern recognizable by hardware. Code fingerprints include, but are notlimited to: data cache hit miss sequences for various cache levels, datacache hit miss sequences for a given instruction at a given cache level,sequences of correct/incorrect predictions for either a code segment orfor a specific set of branches in a code segment, and a branch taken/nottaken history when a given instruction is executed.

The number of code fingerprints that a given processor can recognizewhen code is executed in a computing environment is presently limitedbecause different types of hardware are required to recognize differenttypes of behaviors that comprise different code fingerprints. Thus, agiven processor may only recognize a limited number of codefingerprints, which can lead to issues. For example, if recognition of agiven fingerprint is not supported in a computing environment, theruntime environment has no way of confirming that a certain sequence isoccurring.

SUMMARY

Shortcomings of the prior art are overcome and additional advantages areprovided through the provision of a computer program product forconfiguring a processor to recognize a code fingerprint. The computerprogram product comprises a storage medium readable by a processingcircuit and storing instructions for execution by the processing circuitfor performing a method. The method includes, for instance: defining, bya processor, a code fingerprint, by obtaining parameters describing atleast one of an event type or an event, and wherein the code fingerprintcomprises a first sequence; loading, by the processor, the codefingerprint into a register accessible to the processor; concurrent withexecuting a program, obtaining, by the processor, the code fingerprintfrom the register; identifying, by the processor, the code fingerprintin the program, by comparing a second sequence in the program to thefirst sequence; and based on the identifying, alerting, by theprocessor, a runtime environment, wherein the program is executing inthe runtime environment.

Shortcomings of the prior art are overcome and additional advantages areprovided through the provision of a method of configuring a processor torecognize a code fingerprint. The method includes, for instance:defining, by a processor, a code fingerprint, by obtaining parametersdescribing at least one of an event type or an event, and wherein thecode fingerprint comprises a first sequence; loading, by the processor,the code fingerprint into a register accessible to the processor;concurrent with executing a program, obtaining, by the processor, thecode fingerprint from the register; identifying, by the processor, thecode fingerprint in the program, by comparing a second sequence in theprogram to the first sequence; and based on the identifying, alerting,by the processor, a runtime environment, wherein the program isexecuting in the runtime environment.

Shortcomings of the prior art are overcome and additional advantages areprovided through the provision of a system for configuring a processorto recognize a code fingerprint. The system includes a memory, one ormore processor in communication with the memory, and programinstructions executable by the one or more processor via the memory toperform a method. The method includes, for instance: defining, by aprocessor, a code fingerprint, by obtaining parameters describing atleast one of an event type or an event, and wherein the code fingerprintcomprises a first sequence; loading, by the processor, the codefingerprint into a register accessible to the processor; concurrent withexecuting a program, obtaining, by the processor, the code fingerprintfrom the register; identifying, by the processor, the code fingerprintin the program, by comparing a second sequence in the program to thefirst sequence; and based on the identifying, alerting, by theprocessor, a runtime environment, wherein the program is executing inthe runtime environment.

Methods and systems relating to one or more aspects are also describedand claimed herein. Further, services relating to one or more aspectsare also described and may be claimed herein.

Additional features and advantages are realized through the techniquesdescribed herein. Other embodiments and aspects are described in detailherein and are considered a part of the claimed aspects. For example,aspects of embodiments of the present invention may also include:obtaining, by the processor, additional data and compressing the datautilizing the architected dictionary. The compressing may includewalking, by the processor, from dictionary entries to ranks withoutperforming a memory lookup.

In and embodiment of the present invention, the parameters describe oneof: a load-type event or a branch-type event. In an embodiment of thepresent invention the obtaining parameters further comprises obtaining aplurality of parameters from a source, retaining the plurality ofparameters in a register, and selecting the parameters from theplurality of parameters in the register.

In an embodiment of the present invention the first sequence comprises ameasured sequence and in an embodiment of the present invention, thecode fingerprint comprises a conditional branch sequence with a targetaddress in an instruction.

In an embodiment of the present invention, the comparing of the secondsequence to the first sequence may include obtaining, by the processor,the second sequence from a second register; and comparing, by theprocessor, the first sequence and the second sequence and determiningthat the first sequence and the second sequence are identical.

In an embodiment of the present invention, the comparing of the secondsequence to the first sequence may include obtaining, by the processor,the second sequence from a second register; and comparing, by theprocessor, the first sequence and the second sequence and determiningthat a hamming distance between the first sequence and the secondsequence comprises less than a specified value.

In an embodiment of the present invention, the alerting comprisestriggering, by the processor, a trap. In an embodiment of the presentinvention, the alerting comprises triggering, by the processor, a trapwhen a specific processor behavior described by the code fingerprintoccurs at a given address.

In an embodiment of the present invention, the identifying furthercomprises obtaining, by the processor, the second sequence from theprogram, by identifying when the second sequence occurs in the program,wherein the second sequence comprises the first sequence.

Aspects of certain embodiment of the present invention may also include:defining, by the processor, a new code fingerprint, wherein the new codefingerprint comprises a third sequence; loading, by the processor, thenew code fingerprint into the register accessible to the processor; andconcurrent with the loading the new code fingerprint into the register,loading the code fingerprint into an historical register.

BRIEF DESCRIPTION OF THE DRAWINGS

One or more aspects are particularly pointed out and distinctly claimedas examples in the claims at the conclusion of the specification. Theforegoing and objects, features, and advantages of one or more aspectsare apparent from the following detailed description taken inconjunction with the accompanying drawings in which:

FIG. 1 depicts aspects of an embodiment of the present invention;

FIG. 2 depicts a workflow associated with aspects of an embodiment ofthe present invention;

FIG. 3 depicts aspects of an embodiment of the present invention;

FIG. 4 depicts aspects of an embodiment of the present invention;

FIG. 5 depicts a workflow associated with aspects of an embodiment ofthe present invention;

FIG. 6 depicts a workflow associated with aspects of an embodiment ofthe present invention;

FIG. 7 depicts aspects of an embodiment of the present invention;

FIG. 8 depicts one embodiment of a cloud computing node;

FIG. 9 depicts one embodiment of a cloud computing environment; and

FIG. 10 depicts one example of abstraction model layers.

DETAILED DESCRIPTION

The accompanying figures, in which like reference numerals refer toidentical or functionally similar elements throughout the separate viewsand which are incorporated in and form a part of the specification,further illustrate the present invention and, together with the detaileddescription of the invention, serve to explain the principles of thepresent invention. As understood by one of skill in the art, theaccompanying figures are provided for ease of understanding andillustrate aspects of certain embodiments of the present invention. Theinvention is not limited to the embodiments depicted in the figures.

As understood by one of skill in the art, program code, as referred tothroughout this application, includes both software and hardware. Forexample, program code in certain embodiments of the present inventionincludes fixed function hardware, while other embodiments utilized asoftware-based implementation of the functionality described. Certainembodiments combine both types of program code.

Aspects of certain embodiments of the present invention include programcode 40 (see, FIG. 8) executed by at least one processor 16 (FIG. 8)that enables a runtime environment to configure the at least oneprocessor to recognize a fingerprint. This configurable fingerprintrecognition aspect of certain embodiments of the present inventionprovides an advantage in computing technology because it eliminates thecost of multiple special-purpose fingerprint recognition functions byextending the functionality of a given set of fingerprint logic. Thisaspect of the present invention represents an improvement to existingcomputing technology as presently, in order to recognize a range ofdifferent types of fingerprints, a range of different hardware isrequired in a computing environment.

An advantage of certain embodiments of the present invention is theseembodiments include an aspect that is configurable by a runtimeenvironment to recognize a range of fingerprints. Utilizing thisfunctionality, program code executed by a processor in certainembodiments of the present invention recognizes a range of differentprogram behaviors. Again, this configurable aspect represents animprovement to existing computing technology as presently, in order torecognize a range of different types of fingerprints, a range ofdifferent hardware is required in a computing environment.

Aspects of some embodiments of the present invention may be utilized toverify that certain code segments have been optimized. In a computersystem that does not include aspects of the present invention, a Just inTime (JIT) compiler has optimized a code segment with the expectation ofcausing this segment causing a certain sequence of taken/not takenbranch instructions, or a certain sequence of load hits and misses.However, the processor in this computer system may only provide supportfor fingerprints of some other type (e.g., branch target hits/misses,etc.) due to the cost of supporting each type of fingerprint function.Thus, despite the expected fingerprint associated with this codesegment, the runtime environment of this computer system will not beable to confirm that this optimization, expected to cause a certainbranch taken/not taken sequence, is occurring. By integrating aspects ofcertain embodiments of the present invention into this computer system,the utility that recognizes fingerprints is configurable by the runtimeenvironment, so the processor is not limited by this earlier constraintand can be configured, utilizing aspects of the present invention, torecognize that this optimization is occurring.

Aspects of some embodiments of the present invention may be utilized toenable a runtime environment to identify certain types of behaviors inreal-time. Embodiments of the present invention can be configured by theruntime environment to recognize a wide range of fingerprints, therebyenabling a wide range of program behaviors to be recognizable. In acomputer system where this aspect of the present invention is notavailable, when a runtime environment, for example, attempts to ensurethat data cache misses are never or rarely occurring over a certainsegment of code, it may be unable to do so because the processor mayonly recognize branch type fingerprints. Alternatively, this runtimeenvironment may need an L2 data cache hit fingerprint to ensure aparticular behavior is occurring, but the processor may only provide L1data cache fingerprints. In these examples, due to the limitations ofwhat the processor can recognize, the compiler must use some other meansof identifying the desired behavior, or, depending on the constraints ofthe computer system and its ability to include duplicative hardware, maynot be able to monitor the desired behavior at all. Thus, by integratingaspects of the present invention into the computer system, an embodimentof the present invention can provide the computer system with a singlefingerprint function that is configurable by the runtime environment andtherefore, able to recognize the wide range of fingerprints, enablingprogram code executed by the processor to recognize a wide range ofprogram behaviors.

An advantage of certain embodiments of the present invention is thatthey enable a computer system to include a single type of “generic”hardware. Only one type of hardware is needed as it can be configured torecord and recognize a wide range of fingerprint types and histories.Thus, in certain embodiments of the present invention, the runtimeenvironment can configure this hardware to record and recognize a muchwider range of fingerprints than is currently possible in presentcomputer systems, where the type of fingerprints that can be recognizedby a given hardware unit is static. By providing configurablefingerprint recognition, certain embodiments of the present inventionutilize a single set of hardware instead of multiple hardwiredfingerprint registers, to recognize a given range of fingerprints. Theintegration of this functionality into a single hardware provides moreaccurate measurements of program behavior and provides the opportunityfor improved optimization of the program code.

FIG. 1 illustrates certain aspects of an embodiment of the presentinvention. An embodiment of the present invention includes aconfiguration register 100 in which a runtime environment may configureto recognize one or more fingerprints representing different codesegments and/or behaviors, including but not limited to, sequentialbehaviors of branch or load instruction types. In an embodiment of thepresent invention, the configuration register 100 may be integrated intothe hardware of a processor, for example, in an embodiment of thepresent invention, the configuration register 100 is included in afield-programmable gate array (FPGA) in a processing unit 16.

In an embodiment of the present invention, the configuration register100 includes parameter values 140 that include events 110 a-110 n andtypes of events 120 a-120 n. These parameter values 140 specify the typeof behavior (fingerprint) that program code 40 in the runtimeenvironment may recognize.

In an embodiment of the present invention, the events 110 a-110 n can becontained in the configuration register 100 in a first group 110 and theevent types 120 a-120 n, can be included in the configuration registerin a second group 120. These group designations represent certainnon-limiting embodiments of the present invention. The events 110 a-110n and types of events 120 a-120 b are parameter values 140 that may beutilized by the program code 40 to specify the behavior to be recognizedby a processor.

As illustrated by FIG. 1, in an embodiment of the present invention,these events may include, but are not limited to, Level 1 (L1) load datacache hit/miss sequence 110 a, Level 2 (L2) load data cache hit/misssequence 110 b, Level 3 (L3) load data cache hit/miss sequence 110 c,Branch direction sequence 110 d, Branch direction hit/miss sequence 110e, and Branch target hit/miss sequence 110 f. Parameters values 140 inan embodiment of the present invention may also include additionalevents 110 g-110 n.

Referring to FIG. 1, in an embodiment of the present invention, theconfiguration register 100 also includes events 120 a-120 b. In thisexample, the events include a load-type event, Load instruction 120 a,and a branch-type event, Branch instruction 120 b. Embodiments of thepresent invention may include additional event types 120 c-120 n.

In an embodiment of the present invention, the configuration register100 also includes a Measured Sequence output register 130. As will bedescribed in FIG. 2, program code 40 (see, FIG. 4) utilizes the variousportions of the control register 100 to configure a processor accessingthe register to recognize fingerprints based on behaviors the programcode 40 defined in the control register 100.

For ease of understanding, the workflow 200 of FIG. 2 illustratescertain aspects of an embodiment of the present invention by makingreference to portions of control register 100 of FIG. 1 and to portionsof the computer system in in FIG. 8. As understood by one of skill inthe art, references to this particular embodiment are offered not as alimitation to the aspects described in FIG. 2, but merely to illustratea non-limiting example and are included for ease of understanding.

Referring to FIG. 2, in an embodiment of the present invention, programcode 40 selects parameters related to an event type and an event todefine a code fingerprint (210). As seen in FIG. 1, types of events mayinclude, but are not limited to, load-type events and/or branch-typeevents. Based on selecting a type of event, the program code 40 selectsone or more events. For example, when the program code 40 selects aload-type event, the program code may also 40 select as parameters oneor more event of this type, e.g., L1 load data cache hit/miss sequence110 a, L2 load data cache hit/miss sequence 110 b, and/or L3 load datacache hit/miss sequence 110 c. Similarly, when the program code 40selects a branch-type event as a parameter, the program code 40 canselect a branch event (e.g., Branch direction sequence 110 d, Branchdirection hit/miss sequence 110 e, and Branch target hit/miss sequence110 f).

In an embodiment of the present invention, before selecting theparameters, the program code 40 may obtain the parameters from a source,including a software and/or hardware memory 28 (FIG. 8). The programcode 40 may select certain parameters from the parameters it obtained.

Returning to FIG. 2, in an embodiment of the present invention, asprogram code 40 loads the one or more selected parameters, whichcomprise the code fingerprint, into a register (220). As understood byone of skill in the art, one or more of the aspects described in FIG. 2are carried out by a processor, which executes program code 40. Forexample, as program code 40 executes, the processor may load the one ormore selected parameters, which comprise the code fingerprint, into theregister. In an embodiment of the present invention, this register maybe a Measured Sequence output register 130. Thus, returning to theexamples discussed, when the program code 40 selects a load-type eventis selected, the program code loads the selected type of load event(e.g., L1 load data cache hit/miss sequence 110 a, L2 load data cachehit/miss sequence 110 b, and/or L3 load data cache hit/miss sequence 110c) into the Measured Sequence output register 130. Similarly, when theprogram code 40 selected a branch-type event, the program code loads theselected type of branch event (Branch direction sequence 110 d, Branchdirection hit/miss sequence 110 e, and Branch target hit/miss sequence110 f) into the Measured Sequence output register 130.

In an embodiment of the present invention, if a parameter field in theconfiguration register 100 specifies branch target hit/miss sequence,all unconditional and direct (i.e., sequences with a target address inthe instruction) branch instructions will be hits. Some embodiments mayignore such branch instructions, and include only conditional branchinstructions in the fingerprint.

In an embodiment of the present invention, during execution of aprogram, system, program code 40, which may be understood as theprocessor based on a hardware embodiment (e.g., configured fingerprinthardware) reads the register (e.g., the measured sequence register) toidentify the code fingerprint (i.e., behavior) in the register (230).Some embodiment of the present invention may utilize hardware (i.e., theprogram code term will refer to hardware, an action by the processor) asin some cases, software may not have visibility to cache hit/miss ratiosunless the hardware (e.g., a configured fingerprint recognizer)recognizes the sequences, does the comparison, and causes thelightweight interrupt.

In an embodiment of the present invention, this identifying includes theprogram code 40 comparing the sequence in the register (e.g., thesequence that the program code loaded into the Measured Sequenceregister 130) to a sequence in a second register (e.g., a desiredsequence register). In an embodiment of the present invention, hardware,for example hardware included in a processor of the computing system,compares these sequences. When comparing the sequences, the program code40 may identify identical sequences in the registers and/or the programcode 40 may identify a fuzzy match, which would occur, for example, whena hamming distance between the expected and measured sequences is lessthan a specified value.

Based on identifying the fingerprint in the register, the program code40 alerts the runtime environment that the fingerprint (i.e., behavior)has been recognized (240). In an embodiment of the present invention,the program code 40 alerts the runtime environment by triggering a trap,including but not limited to, a lightweight trap, such as an EBB. In anembodiment of the present invention, the program code 40 identifies abehavior defined by the program in the register when the behavior occursat a given address.

In some embodiments of the present invention, based on the behaviorsdefined in the configuration register 100, the program code 40 may notload selected parameters into a register, including but not limited to,the Measured Sequence output register 130. For example, if the programcode 40 selects a parameter that specifies a branch target hit/misssequence, all unconditional branch instructions and all branchinstructions that have the target in the instruction will be hits. Thus,if there is no need for the program code 40 to load the unconditionalbranch outcomes into the Measured Sequence output register 130, becausethey will be all hits, then in an embodiment of the present invention,an additional input (i.e., event type) can be added to the to the secondgroup 120.

FIG. 3 depicts an embodiment of the present invention where the programcode 40 loads direct branches, and not indirect branches, into aregister. As illustrated in the embodiment, the second group 320includes, instead of a single event type representing a branch-typeevent, Branch instruction 120 b (FIG. 1), and a Direct Branchinstruction 320 b. In an embodiment of the present invention, anIndirect Branch instruction cannot be selected as an event because theprogram code 40 (which, as aforementioned, can be understood as ahardware embodiment) only loads direct branches. A direct branchinstruction comprises a conditional branch (sequence) with a targetaddress in the instruction. Meanwhile, an indirect branch instructioncomprises a conditional branch (sequence) with a target address in aregister.

FIG. 4 depicts an embodiment of the present invention that provides aconfiguration register 400 with configurable fingerprint that includes aselected sequence of values of a multi-bit parameter. These values mayinclude, but are not limited to: a sequence of taken branch targetaddresses, a sequence of taken conditional branch target addresses, asequence of effective addresses loaded or stored, and/or a sequence ofcall signature register values. This embodiment of the present inventionincludes events 410 a-410 n, in a first group 410, from which theprogram code 40 may select to configure a code fingerprint. Although notshown in FIG. 4, in the described embodiment of the present inventionthat include multi-bit parameters, the Events 410 would include thesemulti-bit parameters, including, but not limited to: a sequence of takenbranch target addresses, a sequence of taken conditional branch targetaddresses, a sequence of effective addresses loaded or stored, and/or asequence of call signature register values.

An advantage of this embodiment of the present invention is that itmaintains an historical record of fingerprints configured in theconfiguration register 400 and identified by a processor duringexecution of a program. In the embodiment of FIG. 4, an output register,a Measured Sequence output register 430 a is part of a Measured HistoryBuffer 430. The Measured History Buffer 430 contains a history offingerprints configured, loaded in the output register, and identifiedby program code executed by the processor during program execution. Whenthe program code 40 loads a new code fingerprint to the MeasuredSequence output register 430 a, program code 40 loads the content of theMeasured Sequence output register 430 a, to the first most currenthistorical output register 430 b, loading the content of this registerto the second most current historical output register 430 c. The programcode 40 moves (e.g., downshifts) the content of the remaining registersin the Measured History Buffer 430 accordingly. In an embodiment of thepresent invention, as each such downshift occurs, the program maycompare the Measured Sequence History Buffer 330 to an expected historybuffer (not shown), and if a match between the Measured Sequence HistoryBuffer 330 and the expected sequence history buffer occurs, the programcode 40 may alert the program, or the program code 40 may triggeranother action.

FIG. 5 depicts a workflow 500 associated with aspects of the certainembodiments of the present invention, including the embodimentillustrated by FIG. 4.

In an embodiment of the present invention, program code 40 selectsparameters including at least one event (e.g., loaded address, branchtarget, call signature, etc.) to define a code fingerprint (510). Inthis embodiment of the present invention, each event includes a sequenceof multi-bit values. The program code 40 loads the code fingerprint,which comprises a sequence of multi-bit values, into a registeraccessible to the processor (520). During execution of a program,program code 40 identifies when the sequence comprising the fingerprintoccurs (530). The program code 40 alerts the runtime environment thatthe sequence has occurred (540). The program code 40 may alert theruntime environment by providing a lightweight trap.

As depicted in FIG. 430, in an embodiment of the present invention, theMeasured History Buffer 430 comprises multiple registers, eachcontaining a sequence. In this embodiment, the code fingerprint that theprogram code 40 identifies includes the most-recent “n” multi-bitfingerprints, e.g., the most-recent “n” call signatures. Thus, in thisembodiment, when the program code 40 (e.g., the processor in a hardwareembodiment) determined that all the n most-recent observed callsignatures are the same as the sequence of call signatures that wasconfigured by the program code 40, then the program code 40 generates alightweight interrupt.

FIG. 6 also depicts a workflow 600 associated with aspects of anembodiment of the present invention. In an embodiment of the presentinvention, a processor (e.g., program code executing on a processor)obtains a plurality of parameters from a source (602). The processorretains the plurality of parameters in a register (605), and selectsparameters from the plurality of parameters in the register (608). Theprocessor obtains the parameters describing at least one of an eventtype or an event (610). In an embodiment of the present invention, theprocessor obtains a load-type event or a branch-type event as part ofthe parameters (609).

In an embodiment of the present invention, when the processor obtainsthe plurality of parameters (602), retains the plurality of parameters(605), and selects parameters from the plurality of parameters (608),these aspects of this embodiment of the present invention may be part ofthe processor obtaining parameters describing at least one of an eventtype or an event (610).

In an embodiment of the present invention, the processor obtains aload-type event or a branch-type event as part of the parameters (609)may be part of the processor obtaining parameters describing at leastone of an event type or an event (610).

The code fingerprint includes a first sequence, which may be a measuredsequence. In an embodiment of the present invention, the codefingerprint includes a conditional branch sequence with a target addressin an instruction. The processor loads the code fingerprint into aregister accessible to the processor (620). Concurrent with executing aprogram, the processor obtains the code fingerprint from the register(630).

The processor identifies the code fingerprint in the program bycomparing a second sequence in the program to the first sequence (640).Depending of the embodiment of the present invention, when the processoridentifies the code fingerprint by comparing the sequences, it can do sotaking different approaches, some of which are illustrated in FIG. 6.For example, the processor may compare the first sequence and the secondsequence looking for a match (642). In an embodiment where the processordoes not look for this match, when the processor identifies the codefingerprint, the processor obtains the second sequence from the program,by identifying when the second sequence occurs in the program and thesecond sequence includes the first sequence (644).

FIG. 7 illustrates an example of how, in one example, the processorobtains the second sequence from the program, by identifying when thesecond sequence occurs in the program and the second sequence includesthe first sequence (FIG. 6, 644). In FIG. 2, program code 40 configuredthe Measured Sequence 710, as described earlier. The program code 40provides an Expected Sequence 720, which is a sequence from the programexecuting in the runtime environment of the computer system. Based onreceiving the Expected Sequence 720 from the program code 40, theprocessor compares the Expected Sequence 720 with the fingerprint thatis the Measured Sequence 710. If the sequences match 735, the programcode 40 (processor) generates an alert.

Depending upon the embodiment of the present invention, when theprocessor compares the second sequence and the first sequence, it may belooking for an exact match or an approximate, i.e., fuzzy, match (646).In an embodiment of the present invention, the processor compares thesequences by obtaining the second sequence from a second register,comparing the first sequence and the second sequence, and determinesthat the first sequence and the second sequence are identical (648). Inan embodiment of the present invention, the processor compares thesequences by obtaining the second sequence from a second register,comparing the first sequence and the second sequence, and determinesthat a hamming distance between the first sequence and the secondsequence comprises less than a specified value (649).

In an embodiment of the present invention, when the processor obtainsthe second sequence from the program, by identifying when the secondsequence occurs in the program and the second sequence includes thefirst sequence (644), determines that the first sequence and the secondsequence are identical (648), or determines that a hamming distancebetween the first sequence and the second sequence comprises less than aspecified value (649), these aspects of this embodiment of the presentinvention may each individually comprise the processor identifying thecode fingerprint in the program by comparing a second sequence in theprogram to the first sequence (640).

Based on identifying the code fingerprint, the processor alerts aruntime environment where the program is executing (650). In anembodiment of the present invention, the processor alerts the runtimeenvironment by triggering a lightweight trap (652). In an embodiment ofthe present invention, the processor alerts the runtime environment bytriggering a lightweight trap when a specific processor behaviordescribed by the code fingerprint occurs at a given address.

Returning to FIG. 6, in an embodiment of the present invention, theprocessor defines a new code fingerprint; the new fingerprint includes athird sequence (660). The processor loads the new code fingerprint intothe register accessible to the processor (670). Concurrent with loadingthe new code fingerprint into the register, the processor loads the codefingerprint into an historical register (680). This aspect of certainembodiment of the present the invention was illustrated earlier in FIG.4. As illustrated in FIG. 4, after loading into the historicalregister(s), the processor (also referred to as the program code)compares the set of observed historical measured values to the set ofconfigured values that the program configured into the configurablefingerprint recognition hardware.

One or more aspects may relate to cloud computing.

It is understood in advance that although this disclosure includes adetailed description on cloud computing, implementation of the teachingsrecited herein are not limited to a cloud computing environment. Rather,embodiments of the present invention are capable of being implemented inconjunction with any other type of computing environment now known orlater developed.

Cloud computing is a model of service delivery for enabling convenient,on-demand network access to a shared pool of configurable computingresources (e.g. networks, network bandwidth, servers, processing,memory, storage, applications, virtual machines, and services) that canbe rapidly provisioned and released with minimal management effort orinteraction with a provider of the service. This cloud model may includeat least five characteristics, at least three service models, and atleast four deployment models.

Characteristics are as follows:

On-demand self-service: a cloud consumer can unilaterally provisioncomputing capabilities, such as server time and network storage, asneeded automatically without requiring human interaction with theservice's provider.

Broad network access: capabilities are available over a network andaccessed through standard mechanisms that promote use by heterogeneousthin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

Resource pooling: the provider's computing resources are pooled to servemultiple consumers using a multi-tenant model, with different physicaland virtual resources dynamically assigned and reassigned according todemand. There is a sense of location independence in that the consumergenerally has no control or knowledge over the exact location of theprovided resources but may be able to specify location at a higher levelof abstraction (e.g., country, state, or datacenter).

Rapid elasticity: capabilities can be rapidly and elasticallyprovisioned, in some cases automatically, to quickly scale out andrapidly released to quickly scale in. To the consumer, the capabilitiesavailable for provisioning often appear to be unlimited and can bepurchased in any quantity at any time.

Measured service: cloud systems automatically control and optimizeresource use by leveraging a metering capability at some level ofabstraction appropriate to the type of service (e.g., storage,processing, bandwidth, and active user accounts). Resource usage can bemonitored, controlled, and reported providing transparency for both theprovider and consumer of the utilized service.

Service Models are as follows:

Software as a Service (SaaS): the capability provided to the consumer isto use the provider's applications running on a cloud infrastructure.The applications are accessible from various client devices through athin client interface such as a web browser (e.g., web-based email). Theconsumer does not manage or control the underlying cloud infrastructureincluding network, servers, operating systems, storage, or evenindividual application capabilities, with the possible exception oflimited user-specific application configuration settings.

Platform as a Service (PaaS): the capability provided to the consumer isto deploy onto the cloud infrastructure consumer-created or acquiredapplications created using programming languages and tools supported bythe provider. The consumer does not manage or control the underlyingcloud infrastructure including networks, servers, operating systems, orstorage, but has control over the deployed applications and possiblyapplication hosting environment configurations.

Infrastructure as a Service (IaaS): the capability provided to theconsumer is to provision processing, storage, networks, and otherfundamental computing resources where the consumer is able to deploy andrun arbitrary software, which can include operating systems andapplications. The consumer does not manage or control the underlyingcloud infrastructure but has control over operating systems, storage,deployed applications, and possibly limited control of select networkingcomponents (e.g., host firewalls).

Deployment Models are as follows:

Private cloud: the cloud infrastructure is operated solely for anorganization. It may be managed by the organization or a third party andmay exist on-premises or off-premises.

Community cloud: the cloud infrastructure is shared by severalorganizations and supports a specific community that has shared concerns(e.g., mission, security requirements, policy, and complianceconsiderations). It may be managed by the organizations or a third partyand may exist on-premises or off-premises.

Public cloud: the cloud infrastructure is made available to the generalpublic or a large industry group and is owned by an organization sellingcloud services.

Hybrid cloud: the cloud infrastructure is a composition of two or moreclouds (private, community, or public) that remain unique entities butare bound together by standardized or proprietary technology thatenables data and application portability (e.g., cloud bursting forloadbalancing between clouds).

A cloud computing environment is service oriented with a focus onstatelessness, low coupling, modularity, and semantic interoperability.At the heart of cloud computing is an infrastructure comprising anetwork of interconnected nodes.

Referring now to FIG. 8, a schematic of an example of a cloud computingnode is shown. Cloud computing node 10 is only one example of a suitablecloud computing node and is not intended to suggest any limitation as tothe scope of use or functionality of embodiments of the inventiondescribed herein. Regardless, cloud computing node 10 is capable ofbeing implemented and/or performing any of the functionality set forthhereinabove.

In cloud computing node 10 there is a computer system/server 12, whichis operational with numerous other general purpose or special purposecomputing system environments or configurations. Examples of well-knowncomputing systems, environments, and/or configurations that may besuitable for use with computer system/server 12 include, but are notlimited to, personal computer systems, server computer systems, thinclients, thick clients, handheld or laptop devices, multiprocessorsystems, microprocessor-based systems, set top boxes, programmableconsumer electronics, network PCs, minicomputer systems, mainframecomputer systems, and distributed cloud computing environments thatinclude any of the above systems or devices, and the like.

Computer system/server 12 may be described in the general context ofcomputer system-executable instructions, such as program modules, beingexecuted by a computer system. Generally, program modules may includeroutines, programs, objects, components, logic, data structures, and soon that perform particular tasks or implement particular abstract datatypes. Computer system/server 12 may be practiced in distributed cloudcomputing environments where tasks are performed by remote processingdevices that are linked through a communications network. In adistributed cloud computing environment, program modules may be locatedin both local and remote computer system storage media including memorystorage devices.

As shown in FIG. 8, computer system/server 12 in cloud computing node 10is shown in the form of a general-purpose computing device. Thecomponents of computer system/server 12 may include, but are not limitedto, one or more processors or processing units 16, a system memory 28,and a bus 18 that couples various system components including systemmemory 28 to processor 16.

Bus 18 represents one or more of any of several types of bus structures,including a memory bus or memory controller, a peripheral bus, anaccelerated graphics port, and a processor or local bus using any of avariety of bus architectures. By way of example, and not limitation,such architectures include Industry Standard Architecture (ISA) bus,Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, VideoElectronics Standards Association (VESA) local bus, and PeripheralComponent Interconnect (PCI) bus.

Computer system/server 12 typically includes a variety of computersystem readable media. Such media may be any available media that isaccessible by computer system/server 12, and it includes both volatileand non-volatile media, removable and non-removable media.

System memory 28 can include computer system readable media in the formof volatile memory, such as random access memory (RAM) 30 and/or cachememory 32. Computer system/server 12 may further include otherremovable/non-removable, volatile/non-volatile computer system storagemedia. By way of example only, storage system 34 can be provided forreading from and writing to a non-removable, non-volatile magnetic media(not shown and typically called a “hard drive”). Although not shown, amagnetic disk drive for reading from and writing to a removable,non-volatile magnetic disk (e.g., a “floppy disk”), and an optical diskdrive for reading from or writing to a removable, non-volatile opticaldisk such as a CD-ROM, DVD-ROM or other optical media can be provided.In such instances, each can be connected to bus 18 by one or more datamedia interfaces. As will be further depicted and described below,memory 28 may include at least one program product having a set (e.g.,at least one) of program modules that are configured to carry out thefunctions of embodiments of the invention.

Program/utility 40, having a set (at least one) of program modules 42,may be stored in memory 28 by way of example, and not limitation, aswell as an operating system, one or more application programs, otherprogram modules, and program data. Each of the operating system, one ormore application programs, other program modules, and program data orsome combination thereof, may include an implementation of a networkingenvironment. Program modules 42 generally carry out the functions and/ormethodologies of embodiments of the invention as described herein.

Computer system/server 12 may also communicate with one or more externaldevices 14 such as a keyboard, a pointing device, a display 24, etc.;one or more devices that enable a user to interact with computersystem/server 12; and/or any devices (e.g., network card, modem, etc.)that enable computer system/server 12 to communicate with one or moreother computing devices. Such communication can occur via Input/Output(I/O) interfaces 22. Still yet, computer system/server 12 cancommunicate with one or more networks such as a local area network(LAN), a general wide area network (WAN), and/or a public network (e.g.,the Internet) via network adapter 20. As depicted, network adapter 20communicates with the other components of computer system/server 12 viabus 18. It should be understood that although not shown, other hardwareand/or software components could be used in conjunction with computersystem/server 12. Examples, include, but are not limited to: microcode,device drivers, redundant processing units, external disk drive arrays,RAID systems, tape drives, and data archival storage systems, etc.

Referring now to FIG. 9, illustrative cloud computing environment 50 isdepicted. As shown, cloud computing environment 50 comprises one or morecloud computing nodes 10 with which local computing devices used bycloud consumers, such as, for example, personal digital assistant (PDA)or cellular telephone 54A, desktop computer 54B, laptop computer 54C,and/or automobile computer system 54N may communicate. Nodes 10 maycommunicate with one another. They may be grouped (not shown) physicallyor virtually, in one or more networks, such as Private, Community,Public, or Hybrid clouds as described hereinabove, or a combinationthereof. This allows cloud computing environment 50 to offerinfrastructure, platforms and/or software as services for which a cloudconsumer does not need to maintain resources on a local computingdevice. It is understood that the types of computing devices 54A-N shownin FIG. 9 are intended to be illustrative only and that computing nodes10 and cloud computing environment 50 can communicate with any type ofcomputerized device over any type of network and/or network addressableconnection (e.g., using a web browser).

Referring now to FIG. 10, a set of functional abstraction layersprovided by cloud computing environment 50 (FIG. 8) is shown. It shouldbe understood in advance that the components, layers, and functionsshown in FIG. 9 are intended to be illustrative only and embodiments ofthe invention are not limited thereto. As depicted, the following layersand corresponding functions are provided:

Hardware and software layer 60 includes hardware and softwarecomponents. Examples of hardware components include mainframes 61; RISC(Reduced Instruction Set Computer) architecture based servers 62;servers 63; blade servers 64; storage devices 65; and networks andnetworking components 66. In some embodiments, software componentsinclude network application server software 67 and database software 68.

Virtualization layer 70 provides an abstraction layer from which thefollowing examples of virtual entities may be provided: virtual servers71; virtual storage 72; virtual networks 73, including virtual privatenetworks; virtual applications and operating systems 74; and virtualclients 75.

In one example, management layer 80 may provide the functions describedbelow, which may include maintaining VPD at a VPD location the computersystem. Resource provisioning 81 provides dynamic procurement ofcomputing resources and other resources that are utilized to performtasks within the cloud computing environment. Metering and Pricing 82provide cost tracking as resources are utilized within the cloudcomputing environment, and billing or invoicing for consumption of theseresources. In one example, these resources may comprise applicationsoftware licenses. Security provides identity verification for cloudconsumers and tasks, as well as protection for data and other resources.User portal 83 provides access to the cloud computing environment forconsumers and system administrators. Service level management 84provides cloud computing resource allocation and management such thatrequired service levels are met. Service Level Agreement (SLA) planningand fulfillment 85 provide pre-arrangement for, and procurement of,cloud computing resources for which a future requirement is anticipatedin accordance with an SLA.

Workloads layer 90 provides examples of functionality for which thecloud computing environment may be utilized. Examples of workloads andfunctions which may be provided from this layer include: mapping andnavigation 91; software development and lifecycle management 92; virtualclassroom education delivery 93; data analytics processing 94;transaction processing 95; and alerting a runtime environment that thesequence has occurred in the code being executed in the environment.

Aspects of the present invention are described herein with reference toflowchart illustrations and/or block diagrams of methods, apparatus(systems), and computer program products according to embodiments of theinvention. It will be understood that each block of the flowchartillustrations and/or block diagrams, and combinations of blocks in theflowchart illustrations and/or block diagrams, can be implemented bycomputer readable program instructions.

These computer readable program instructions may be provided to aprocessor of a general purpose computer, special purpose computer, orother programmable data processing apparatus to produce a machine, suchthat the instructions, which execute via the processor of the computeror other programmable data processing apparatus, create means forimplementing the functions/acts specified in the flowchart and/or blockdiagram block or blocks. These computer readable program instructionsmay also be stored in a computer readable storage medium that can directa computer, a programmable data processing apparatus, and/or otherdevices to function in a particular manner, such that the computerreadable storage medium having instructions stored therein comprises anarticle of manufacture including instructions which implement aspects ofthe function/act specified in the flowchart and/or block diagram blockor blocks.

The computer readable program instructions may also be loaded onto acomputer, other programmable data processing apparatus, or other deviceto cause a series of operational steps to be performed on the computer,other programmable apparatus or other device to produce a computerimplemented process, such that the instructions which execute on thecomputer, other programmable apparatus, or other device implement thefunctions/acts specified in the flowchart and/or block diagram block orblocks.

The flowchart and block diagrams in the Figures illustrate thearchitecture, functionality, and operation of possible implementationsof systems, methods, and computer program products according to variousembodiments of the present invention. In this regard, each block in theflowchart or block diagrams may represent a module, segment, or portionof instructions, which comprises one or more executable instructions forimplementing the specified logical function(s). In some alternativeimplementations, the functions noted in the block may occur out of theorder noted in the figures. For example, two blocks shown in successionmay, in fact, be executed substantially concurrently, or the blocks maysometimes be executed in the reverse order, depending upon thefunctionality involved. It will also be noted that each block of theblock diagrams and/or flowchart illustration, and combinations of blocksin the block diagrams and/or flowchart illustration, can be implementedby special purpose hardware-based systems that perform the specifiedfunctions or acts or carry out combinations of special purpose hardwareand computer instructions.

In addition to the above, one or more aspects may be provided, offered,deployed, managed, serviced, etc. by a service provider who offersmanagement of customer environments. For instance, the service providercan create, maintain, support, etc. computer code and/or a computerinfrastructure that performs one or more aspects for one or morecustomers. In return, the service provider may receive payment from thecustomer under a subscription and/or fee agreement, as examples.Additionally or alternatively, the service provider may receive paymentfrom the sale of advertising content to one or more third parties.

In one aspect, an application may be deployed for performing one or moreembodiments. As one example, the deploying of an application comprisesproviding computer infrastructure operable to perform one or moreembodiments.

As a further aspect, a computing infrastructure may be deployedcomprising integrating computer readable code into a computing system,in which the code in combination with the computing system is capable ofperforming one or more embodiments.

As yet a further aspect, a process for integrating computinginfrastructure comprising integrating computer readable code into acomputer system may be provided. The computer system comprises acomputer readable medium, in which the computer medium comprises one ormore embodiments. The code in combination with the computer system iscapable of performing one or more embodiments.

Although various embodiments are described above, these are onlyexamples. For example, computing environments of other architectures canbe used to incorporate and use one or more embodiments. Further,different instructions, instruction formats, instruction fields and/orinstruction values may be used. Many variations are possible.

Further, other types of computing environments can benefit and be used.As an example, a data processing system suitable for storing and/orexecuting program code is usable that includes at least two processorscoupled directly or indirectly to memory elements through a system bus.The memory elements include, for instance, local memory employed duringactual execution of the program code, bulk storage, and cache memorywhich provide temporary storage of at least some program code in orderto reduce the number of times code must be retrieved from bulk storageduring execution.

Input/Output or I/O devices (including, but not limited to, keyboards,displays, pointing devices, DASD, tape, CDs, DVDs, thumb drives andother memory media, etc.) can be coupled to the system either directlyor through intervening I/O controllers. Network adapters may also becoupled to the system to enable the data processing system to becomecoupled to other data processing systems or remote printers or storagedevices through intervening private or public networks. Modems, cablemodems, and Ethernet cards are just a few of the available types ofnetwork adapters.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting. As used herein, thesingular forms “a”, “an” and “the” are intended to include the pluralforms as well, unless the context clearly indicates otherwise. It willbe further understood that the terms “comprises” and/or “comprising”,when used in this specification, specify the presence of statedfeatures, integers, steps, operations, elements, and/or components, butdo not preclude the presence or addition of one or more other features,integers, steps, operations, elements, components and/or groups thereof.

The corresponding structures, materials, acts, and equivalents of allmeans or step plus function elements in the claims below, if any, areintended to include any structure, material, or act for performing thefunction in combination with other claimed elements as specificallyclaimed. The description of one or more embodiments has been presentedfor purposes of illustration and description, but is not intended to beexhaustive or limited to in the form disclosed. Many modifications andvariations will be apparent to those of ordinary skill in the art. Theembodiment was chosen and described in order to best explain variousaspects and the practical application, and to enable others of ordinaryskill in the art to understand various embodiments with variousmodifications as are suited to the particular use contemplated.

What is claimed is:
 1. A computer-implemented method, comprising:defining, by one or more processors, a code fingerprint based onselecting parameters related to an event type and an event type;loading, by the one or more processors, the code fingerprint into aregister accessible to the one or more processors; during execution of aprogram in a runtime environment, reading, by the one or moreprocessors, the register to identify the code fingerprint in theregister; identifying, the by the one or more processors, the codefingerprint in the register; and alerting, by the one or moreprocessors, the runtime environment that the code fingerprint has beenidentified, based on the identifying.
 2. The computer-implemented methodof claim 1, wherein the event type is selected from the group consistingof: a load-type event and a branch-type event.
 3. Thecomputer-implemented method of claim 2, wherein based on selecting theevent type, selecting, by the one or more processors, one or more eventsof the event type as a portion of the parameters.
 4. Thecomputer-implemented method of claim 3, wherein the event type selectedis the branch event type event and the one or more events are selectedfrom the group consisting of: a branch direction sequence, a branchdirection hit/miss sequence, and a branch target hit/miss sequence. 5.The computer-implemented method of claim 4, wherein the code fingerprintcomprises a parameter field in the register, wherein the parameter fieldspecifies the branch target hit/miss sequence, and wherein based on theparameter field, the identifying is based on a direct or indirect branchinstructions comprising the program.
 6. The computer-implemented methodof claim 4, wherein the code fingerprint comprises conditional branchinstructions, and wherein the identifying is based on conditional branchinstructions comprising the program and the reading comprises ignoringdirect or indirect branch instructions comprising the program.
 7. Thecomputer-implemented method of claim 3, wherein the event type selectedis the load-type event and the one or more events are selected from thegroup consisting of: a L1 load data cache hit/miss sequence, a L2 loaddata cache hit/miss sequence, and a L3 load data cache hit/misssequence.
 8. The computer-implemented method of claim 1, whereinselecting the parameters comprises selecting the parameters from asource.
 9. The computer-implemented method of claim 8, wherein thesource comprises a memory selected from the group consisting of: ahardware memory and a software memory.
 10. The computer-implementedmethod of claim 1, further comprising: providing, by the one or moreprocessors, visibility to the program with visibility to the registerbased on the identifying.
 11. A computer program product comprising: acomputer readable storage medium readable by one or more processors andstoring instructions for execution by the one or more processors forperforming a method comprising: defining, by the one or more processors,a code fingerprint based on selecting parameters related to an eventtype and an event type; loading, by the one or more processors, the codefingerprint into a register accessible to the one or more processors;during execution of a program in a runtime environment, reading, by theone or more processors, the register to identify the code fingerprint inthe register; identifying, the by the one or more processors, the codefingerprint in the register; and alerting, by the one or moreprocessors, the runtime environment that the code fingerprint has beenidentified, based on the identifying.
 12. The computer program productof claim 11, wherein the event type is selected from the groupconsisting of: a load-type event and a branch-type event.
 13. Thecomputer program product of claim 12, wherein based on selecting theevent type, selecting, by the one or more processors, one or more eventsof the event type as a portion of the parameters.
 14. The computerprogram product of claim 13, wherein the event type selected is thebranch event type event and the one or more events are selected from thegroup consisting of: a branch direction sequence, a branch directionhit/miss sequence, and a branch target hit/miss sequence.
 15. Thecomputer program product of claim 14, wherein the code fingerprintcomprises a parameter field in the register, wherein the parameter fieldspecifies the branch target hit/miss sequence, and wherein based on theparameter field, the identifying is based on a direct or indirect branchinstructions comprising the program.
 16. The computer program product ofclaim 14, wherein the code fingerprint comprises conditional branchinstructions, and wherein the identifying is based on conditional branchinstructions comprising the program and the reading comprises ignoringdirect or indirect branch instructions comprising the program.
 17. Thecomputer program product of claim 13, wherein the event type selected isthe load-type event and the one or more events are selected from thegroup consisting of: a L1 load data cache hit/miss sequence, a L2 loaddata cache hit/miss sequence, and a L3 load data cache hit/misssequence.
 18. The computer program product of claim 11, whereinselecting the parameters comprises selecting the parameters from asource.
 19. The computer program product of claim 18, wherein the sourcecomprises a memory selected from the group consisting of: a hardwarememory and a software memory.
 20. A system comprising: a memory; one ormore processors in communication with the memory; and programinstructions executable by the one or more processors via the memory toperform a method, the method comprising: defining, by the one or moreprocessors, a code fingerprint based on selecting parameters related toan event type and an event type; loading, by the one or more processors,the code fingerprint into a register accessible to the one or moreprocessors; during execution of a program in a runtime environment,reading, by the one or more processors, the register to identify thecode fingerprint in the register; identifying, the by the one or moreprocessors, the code fingerprint in the register; and alerting, by theone or more processors, the runtime environment that the codefingerprint has been identified, based on the identifying.